This article contains frequently asked questions about Identity-Aware Proxy (IAP).
What apps can I secure with IAP?
IAP can be used with:
- App Engine standard environment and App Engine flexible environment apps.
- Compute Engine instances with HTTP(S) load balancing backend services.
- Google Kubernetes Engine containers.
Currently, IAP cannot be used with Cloud CDN.
Why is there a # at the end of my URL after signing in to my app?
In some browsers and under certain conditions, a
# may be appended to the
URL after authentication. This is normal and won't cause issues when logging in.
Why are my requests failing and returning a 405 Method Not Allowed status code?
The way you include cookies varies between request methods. For example,
requests sent with an
withCredentials property set to
true, while requests sent with the
credentials option set to
For information on handling errors that only occur after some time has passed, see Managing IAP sessions.
Why am I receiving an HTTP 401 Unauthorized status code instead of an HTTP 302 Redirect?
IAP responds with a
302 Redirect status code when a client
is configured to handle redirects. To indicate that your client can handle
redirects, ensure that
HTTP Accept="text/html,*/*" is in the header of
Why are POST requests not triggering redirects?
To trigger redirects, ensure that calls to IAP aren't
POST requests. Browsers don't redirect as a response to POST requests. Because
of this, IAP responds with a
401 Unauthorized status code
instead of a
If you need IAP to serve POST requests, ensure that either the ID token or valid cookies are being passed in the header of the request.
Include the ID token in an
Authorization: Bearer header to make an
authenticated request to the IAP-secured resource.
Obtain valid cookies by refreshing the session.
IAP expects the following cookie prefixes:
It's normal for these cookies to appear multiple times in a request header.
Can I use IAP if I have disabled the API?
Yes, access to resources secured with IAP works with the API disabled, but you won't be able to make changes to IAM permissions.
How can I restrict users with the Owner role from using IAP for TCP?
First, avoid using the Owner (
roles/owner) role as much as possible. The Owner
role grants wide permissions across Google Cloud. Assigning more granular
roles and permissions can increase the security of your project. To learn more,
see the IAM best practices.
If you cannot reduce usage of the Owner role, you can block IAP for TCP using Firewall rules.
What domain does IAP for TCP use?
IAP TCP tunnels data through the domain
tunnel.cloudproxy.app. This domain is
owned by Google. You should ensure you are not blocking any traffic to this
If you block traffic to this domain you will be unable to use IAP for TCP. You might receive one of several error messages.
If you are using
gcloud, the error message might be
Error while connecting [[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed
If you are using SSH from the browser the error message is
Cloud Identity-Aware Proxy Failed
There is no associated error code.
The following table lists common error codes and messages that return when configuring and using IAP.
|Error code or message||Description||Troubleshooting|
|Error Code 7||Your OAuth client ID or secret values are empty.||Verify that your client ID and secret are correctly configured for your app by viewing the Credentials page. If your client ID and secret appear to be configured correctly, use the
|Error Code 9||An OAuth redirect didn't complete.||This is an internal error and has been logged for review.|
|Error Code 9 (With path rewrite rules)||An OAuth redirect didn't complete.||Google Cloud Load Balancer path rewrite rules interferes with IAP's ability to successfully complete an OAuth flow. If you host multiple backends behind Google Cloud load balancer and use path rewrite rules, ensure that both the backends are using the same OAuth client IDs for IAP. You can change an OAuth client ID for a backend service by using the gcloud compute backend-services update command.|
|Error Code 11||Your OAuth client ID is incorrectly configured.||Verify that your client ID and secret are correctly configured for your app by viewing the Credentials page. If your client ID and secret appear to be configured correctly, use the
|Error Code 13||Your OpenID Connect (OIDC) token is invalid.||Ensure that the client ID configured for IAP isn't deleted by viewing the Credentials page.|
|Error code 51||Your browser does not support connection pooling.||A current, up to date browser can handle connection pooling errors. Ensure that end users are using a current and up to date browser.|
|Error code 52||The host name provided does not match the SSL certificate on the server.||The system administrator might need to update the SSL certificate.|
|Error Code 429||Your project has exceeded the per-minute threshold for requests.||IAP projects are limited to a maximum of 360,000 requests per minute. If you encounter this error, reduce the volume of requests for your project. You can contact Google Cloud Support if you have additional questions.|
|Error Code 4003||This might mean the instance isn't listening on the port you're trying to connect to or the firewall is closed. Either of those issues could also cause the start-up connectivity test to the VM instance to fail.||Ensure that the listening process on the VM is running and listening on the correct port. Also, verify that your Google Cloud firewall is configured correctly and open on the port you're connecting to.|
|Error Code 4033||Either you don't have permission to access the instance, the instance doesn't exist, or the instance is stopped.||Ensure that you have the IAP-secured Tunnel User IAM role applied on the resource you're connecting to by viewing the Identity-Aware Proxy page.|
|Error Code 4047||Either the instance doesn't exist, or the instance is stopped.||Ensure that the VM is powered on and has completed its startup.|
If you're unable to resolve your issue, please contact customer support with
the description of your error and the response you get from a
GET call to the
API. You can remove your client secret from the response.